cvs commit: src/sys/dev/fxp if_fxp.c

[Maxime Henrion]

Kris Kennaway wrote:
> On Wed, Mar 16, 2005 at 04:39:04PM +0000, Maxime Henrion wrote:
> > mux         2005-03-16 16:39:04 UTC
> > 
> >   FreeBSD src repository
> > 
> >   Modified files:
> >     sys/dev/fxp          if_fxp.c 
> >   Log:
> >   Unload and destroy the TX DMA maps before destroying the DMA tag
> >   they're attached to, not after.
> >   
> >   Spotted by:     Coverity via sam
> 
> Is this likely to have caused panics at runtime?  A few people
> (including me) have seen dma-related or use-after-free panics from
> fxp.

This won't fix any use-after-free panics at runtime, since the faulty
code is in fxp_release() which will only get called from fxp_attach() in
error scenarios and from fxp_detach().

I've never seen reports about use-after-free from fxp(4), I'd like to
know about those, even if the odds of those not being false positives is
small...

Cheers,
Maxime